[PATCH] wifi: mt76: drain mt76x02 DFS tasklet during teardown

[Jiale Yao]

The MMIO interrupt path can leave dfs_tasklet pending when an mt76x0e or
mt76x2e device is removed.  Disabling the tasklet does not remove
pending work from the tasklet queue, and the cleanup paths eventually
free the device containing both the tasklet and the DFS state it uses.

Kill the DFS tasklet before tearing down the DMA engine and device
state.

Fixes: 7bc04215a66b ("mt76: add driver code for MT76x2e")
Cc: stable at vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02 at 163.com>
---
 drivers/net/wireless/mediatek/mt76/mt76x0/pci.c      | 1 +
 drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c | 3 +--
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c b/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c
index f8d206a07f99..0c6befdbb98e 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c
@@ -224,6 +224,7 @@ mt76x0e_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 static void mt76x0e_cleanup(struct mt76x02_dev *dev)
 {
 	clear_bit(MT76_STATE_INITIALIZED, &dev->mphy.state);
+	tasklet_kill(&dev->dfs_pd.dfs_tasklet);
 	tasklet_disable(&dev->mt76.pre_tbtt_tasklet);
 	mt76x0_chip_onoff(dev, false, false);
 	mt76x0e_stop_hw(dev);
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c
index bec84f932311..e454efab9739 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c
@@ -280,7 +280,7 @@ void mt76x2_stop_hardware(struct mt76x02_dev *dev)
 
 void mt76x2_cleanup(struct mt76x02_dev *dev)
 {
-	tasklet_disable(&dev->dfs_pd.dfs_tasklet);
+	tasklet_kill(&dev->dfs_pd.dfs_tasklet);
 	tasklet_disable(&dev->mt76.pre_tbtt_tasklet);
 	mt76x2_stop_hardware(dev);
 	mt76_dma_cleanup(&dev->mt76);
@@ -317,4 +317,3 @@ int mt76x2_register_device(struct mt76x02_dev *dev)
 	mt76x2_stop_hardware(dev);
 	return ret;
 }
-
-- 
2.34.1